CVE-2024-12571: LotsOfLocales WordPress Plugin RCE Flaw

CVE-2024-12571 Overview

The Store Locator for WordPress with Google Maps – LotsOfLocales plugin for WordPress contains a critical Local File Inclusion (LFI) vulnerability in version 3.98.9. The vulnerability exists in the sl_engine parameter, which fails to properly sanitize user-supplied input before including files on the server. This security flaw enables unauthenticated attackers to include and execute arbitrary files on the target server, potentially leading to remote code execution, unauthorized data access, and complete system compromise.

Critical Impact

Unauthenticated attackers can achieve remote code execution by exploiting the Local File Inclusion vulnerability to include malicious PHP files, potentially gaining full control of affected WordPress installations.

Affected Products

• Store Locator for WordPress with Google Maps – LotsOfLocales plugin version 3.98.9
• WordPress installations running vulnerable plugin versions

Discovery Timeline

• 2024-12-20 - CVE CVE-2024-12571 published to NVD
• 2024-12-20 - Last updated in NVD database

Technical Details for CVE-2024-12571

Vulnerability Analysis

This Local File Inclusion vulnerability (CWE-98) occurs due to improper input validation in the sl_engine parameter within the plugin's core functionality. The vulnerable code path resides in sl-functions.php and fails to adequately sanitize or validate file paths before including them in PHP execution context.

The flaw allows attackers to manipulate the sl_engine parameter to traverse directories and include arbitrary files from the server filesystem. When combined with the ability to upload files with controlled content (such as images containing embedded PHP code), this vulnerability escalates to full remote code execution.

The attack does not require authentication, making it particularly dangerous for publicly accessible WordPress sites. Successful exploitation could allow attackers to bypass access controls, exfiltrate sensitive data including database credentials and configuration files, or establish persistent backdoor access to the compromised server.

Root Cause

The root cause is insufficient input validation and sanitization of the sl_engine parameter in the sl-functions.php file at line 1919. The code directly uses user-controlled input in file inclusion operations without proper path traversal filtering or whitelist validation. This allows attackers to break out of intended directories and include files from anywhere on the filesystem that the web server process can read.

Attack Vector

The vulnerability is exploitable remotely over the network without any authentication requirements. An attacker can craft malicious HTTP requests containing path traversal sequences (such as ../) in the sl_engine parameter to include arbitrary server files. The attack complexity is low as it requires only basic knowledge of path traversal techniques and the target's file structure.

The exploitation typically follows this pattern: the attacker identifies the vulnerable endpoint, crafts a request with a manipulated sl_engine parameter pointing to a sensitive file or a previously uploaded malicious file, and the server executes the included file's PHP code in the context of the WordPress application. This can lead to reading sensitive configuration files, including uploaded PHP webshells, or chaining with other vulnerabilities to achieve persistent compromise.

Detection Methods for CVE-2024-12571

Indicators of Compromise

• Suspicious HTTP requests containing path traversal sequences (../, ..%2f, ..%252f) targeting the Store Locator plugin endpoints
• Unusual file access patterns in web server logs showing attempts to read files outside the plugin directory
• Presence of unexpected PHP files in upload directories or temporary locations
• Evidence of unauthorized configuration file access or database credential exfiltration

Detection Strategies

• Monitor web application firewall (WAF) logs for path traversal patterns in requests to WordPress plugin endpoints
• Implement file integrity monitoring on WordPress installations to detect unauthorized file modifications or additions
• Review web server access logs for requests containing suspicious sl_engine parameter values
• Deploy intrusion detection rules to alert on LFI attack patterns targeting the vulnerable plugin

Monitoring Recommendations

• Enable detailed logging for all HTTP requests to WordPress plugin endpoints
• Configure real-time alerting for path traversal attempts and suspicious file inclusion patterns
• Monitor system file access to detect reads of sensitive files like wp-config.php or /etc/passwd
• Track file upload activity and scan uploaded content for embedded PHP code

How to Mitigate CVE-2024-12571

Immediate Actions Required

• Immediately disable or remove the Store Locator for WordPress with Google Maps – LotsOfLocales plugin version 3.98.9 if actively in use
• Review web server logs for evidence of exploitation attempts targeting the sl_engine parameter
• Implement Web Application Firewall (WAF) rules to block path traversal attempts targeting WordPress plugins
• Audit the WordPress installation for unauthorized file modifications or suspicious uploaded files

Patch Information

Affected organizations should check the official WordPress plugin repository for an updated version of the Store Locator for WordPress with Google Maps – LotsOfLocales plugin that addresses this vulnerability. For technical details about the vulnerable code, refer to the WordPress Plugin Code Review and the Wordfence Vulnerability Analysis.

Workarounds

• Deactivate and delete the vulnerable plugin until a patched version is available
• Implement strict input validation at the web server or WAF level to block path traversal patterns
• Restrict file system permissions to limit the web server's ability to read sensitive files outside the web root
• Consider using WordPress security plugins that provide virtual patching capabilities to block exploitation attempts

# Configuration example - Apache mod_rewrite rule to block path traversal attempts
# Add to .htaccess in WordPress root directory
RewriteEngine On
RewriteCond %{QUERY_STRING} (\.\./) [NC,OR]
RewriteCond %{QUERY_STRING} (sl_engine=.*\.\.) [NC]
RewriteRule .* - [F,L]